Configura IAM para la solución Bare Metal

Cuando deseas que una principal, como un usuario o una cuenta de servicio del Google Cloud proyecto, obtenga acceso a los recursos en el entorno de la solución Bare Metal, debes otorgarle los roles y permisos adecuados. Para otorgar acceso, puedes crear una política de administración de identidades y accesos (IAM) y asignar roles predefinidos específicos a la solución Bare Metal.

Otorga roles con permisos suficientes para que tus principales puedan realizar su trabajo, pero no más, de modo que puedas seguir el principio de privilegio mínimo de seguridad de Google Cloud.

Funciones predefinidas para la solución Bare Metal

Cada función de IAM para la solución Bare Metal contiene permisos que otorgan al principal acceso a recursos específicos, como se muestra en la siguiente tabla.

Role Permissions

(roles/baremetalsolution.admin)

Administrator of Bare Metal Solution resources

baremetalsolution.instancequotas.list

baremetalsolution.instances.*

  • baremetalsolution.instances.attachNetwork
  • baremetalsolution.instances.attachVolume
  • baremetalsolution.instances.create
  • baremetalsolution.instances.detachLun
  • baremetalsolution.instances.detachNetwork
  • baremetalsolution.instances.detachVolume
  • baremetalsolution.instances.disableInteractiveSerialConsole
  • baremetalsolution.instances.enableInteractiveSerialConsole
  • baremetalsolution.instances.get
  • baremetalsolution.instances.list
  • baremetalsolution.instances.rename
  • baremetalsolution.instances.reset
  • baremetalsolution.instances.start
  • baremetalsolution.instances.stop
  • baremetalsolution.instances.update

baremetalsolution.luns.*

  • baremetalsolution.luns.create
  • baremetalsolution.luns.delete
  • baremetalsolution.luns.evict
  • baremetalsolution.luns.get
  • baremetalsolution.luns.list
  • baremetalsolution.luns.update

baremetalsolution.maintenanceevents.*

  • baremetalsolution.maintenanceevents.addProposal
  • baremetalsolution.maintenanceevents.approve
  • baremetalsolution.maintenanceevents.get
  • baremetalsolution.maintenanceevents.list

baremetalsolution.networkquotas.list

baremetalsolution.networks.*

  • baremetalsolution.networks.create
  • baremetalsolution.networks.delete
  • baremetalsolution.networks.get
  • baremetalsolution.networks.list
  • baremetalsolution.networks.rename
  • baremetalsolution.networks.update

baremetalsolution.nfsshares.*

  • baremetalsolution.nfsshares.create
  • baremetalsolution.nfsshares.delete
  • baremetalsolution.nfsshares.get
  • baremetalsolution.nfsshares.list
  • baremetalsolution.nfsshares.rename
  • baremetalsolution.nfsshares.update

baremetalsolution.operations.get

baremetalsolution.osimages.list

baremetalsolution.pods.list

baremetalsolution.procurements.get

baremetalsolution.procurements.list

baremetalsolution.skus.list

baremetalsolution.snapshotschedulepolicies.*

  • baremetalsolution.snapshotschedulepolicies.create
  • baremetalsolution.snapshotschedulepolicies.delete
  • baremetalsolution.snapshotschedulepolicies.get
  • baremetalsolution.snapshotschedulepolicies.list
  • baremetalsolution.snapshotschedulepolicies.update

baremetalsolution.sshKeys.*

  • baremetalsolution.sshKeys.create
  • baremetalsolution.sshKeys.delete
  • baremetalsolution.sshKeys.list

baremetalsolution.storageaggregatepools.list

baremetalsolution.volumequotas.list

baremetalsolution.volumes.*

  • baremetalsolution.volumes.create
  • baremetalsolution.volumes.delete
  • baremetalsolution.volumes.evict
  • baremetalsolution.volumes.get
  • baremetalsolution.volumes.list
  • baremetalsolution.volumes.rename
  • baremetalsolution.volumes.resize
  • baremetalsolution.volumes.update

baremetalsolution.volumesnapshots.*

  • baremetalsolution.volumesnapshots.create
  • baremetalsolution.volumesnapshots.delete
  • baremetalsolution.volumesnapshots.get
  • baremetalsolution.volumesnapshots.list
  • baremetalsolution.volumesnapshots.restore

resourcemanager.projects.get

resourcemanager.projects.list

(roles/baremetalsolution.editor)

Editor of Bare Metal Solution resources

baremetalsolution.instancequotas.list

baremetalsolution.instances.*

  • baremetalsolution.instances.attachNetwork
  • baremetalsolution.instances.attachVolume
  • baremetalsolution.instances.create
  • baremetalsolution.instances.detachLun
  • baremetalsolution.instances.detachNetwork
  • baremetalsolution.instances.detachVolume
  • baremetalsolution.instances.disableInteractiveSerialConsole
  • baremetalsolution.instances.enableInteractiveSerialConsole
  • baremetalsolution.instances.get
  • baremetalsolution.instances.list
  • baremetalsolution.instances.rename
  • baremetalsolution.instances.reset
  • baremetalsolution.instances.start
  • baremetalsolution.instances.stop
  • baremetalsolution.instances.update

baremetalsolution.luns.*

  • baremetalsolution.luns.create
  • baremetalsolution.luns.delete
  • baremetalsolution.luns.evict
  • baremetalsolution.luns.get
  • baremetalsolution.luns.list
  • baremetalsolution.luns.update

baremetalsolution.maintenanceevents.*

  • baremetalsolution.maintenanceevents.addProposal
  • baremetalsolution.maintenanceevents.approve
  • baremetalsolution.maintenanceevents.get
  • baremetalsolution.maintenanceevents.list

baremetalsolution.networkquotas.list

baremetalsolution.networks.*

  • baremetalsolution.networks.create
  • baremetalsolution.networks.delete
  • baremetalsolution.networks.get
  • baremetalsolution.networks.list
  • baremetalsolution.networks.rename
  • baremetalsolution.networks.update

baremetalsolution.nfsshares.*

  • baremetalsolution.nfsshares.create
  • baremetalsolution.nfsshares.delete
  • baremetalsolution.nfsshares.get
  • baremetalsolution.nfsshares.list
  • baremetalsolution.nfsshares.rename
  • baremetalsolution.nfsshares.update

baremetalsolution.operations.get

baremetalsolution.osimages.list

baremetalsolution.pods.list

baremetalsolution.procurements.get

baremetalsolution.procurements.list

baremetalsolution.skus.list

baremetalsolution.snapshotschedulepolicies.*

  • baremetalsolution.snapshotschedulepolicies.create
  • baremetalsolution.snapshotschedulepolicies.delete
  • baremetalsolution.snapshotschedulepolicies.get
  • baremetalsolution.snapshotschedulepolicies.list
  • baremetalsolution.snapshotschedulepolicies.update

baremetalsolution.sshKeys.*

  • baremetalsolution.sshKeys.create
  • baremetalsolution.sshKeys.delete
  • baremetalsolution.sshKeys.list

baremetalsolution.storageaggregatepools.list

baremetalsolution.volumequotas.list

baremetalsolution.volumes.*

  • baremetalsolution.volumes.create
  • baremetalsolution.volumes.delete
  • baremetalsolution.volumes.evict
  • baremetalsolution.volumes.get
  • baremetalsolution.volumes.list
  • baremetalsolution.volumes.rename
  • baremetalsolution.volumes.resize
  • baremetalsolution.volumes.update

baremetalsolution.volumesnapshots.*

  • baremetalsolution.volumesnapshots.create
  • baremetalsolution.volumesnapshots.delete
  • baremetalsolution.volumesnapshots.get
  • baremetalsolution.volumesnapshots.list
  • baremetalsolution.volumesnapshots.restore

resourcemanager.projects.get

resourcemanager.projects.list

(roles/baremetalsolution.instancesadmin)

Admin of Bare Metal Solution Instance resources

baremetalsolution.instances.*

  • baremetalsolution.instances.attachNetwork
  • baremetalsolution.instances.attachVolume
  • baremetalsolution.instances.create
  • baremetalsolution.instances.detachLun
  • baremetalsolution.instances.detachNetwork
  • baremetalsolution.instances.detachVolume
  • baremetalsolution.instances.disableInteractiveSerialConsole
  • baremetalsolution.instances.enableInteractiveSerialConsole
  • baremetalsolution.instances.get
  • baremetalsolution.instances.list
  • baremetalsolution.instances.rename
  • baremetalsolution.instances.reset
  • baremetalsolution.instances.start
  • baremetalsolution.instances.stop
  • baremetalsolution.instances.update

baremetalsolution.operations.get

baremetalsolution.osimages.list

baremetalsolution.pods.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/baremetalsolution.instancesviewer)

Viewer of Bare Metal Solution Instance resources

baremetalsolution.instancequotas.list

baremetalsolution.instances.get

baremetalsolution.instances.list

baremetalsolution.operations.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/baremetalsolution.lunsadmin)

Administrator of Bare Metal Solution Lun resources

baremetalsolution.luns.get

baremetalsolution.luns.list

baremetalsolution.operations.get

(roles/baremetalsolution.lunsviewer)

Viewer of Bare Metal Solution Lun resources

baremetalsolution.luns.get

baremetalsolution.luns.list

baremetalsolution.operations.get

(roles/baremetalsolution.maintenanceeventsadmin)

Administrator of Bare Metal Solution maintenance events resources

baremetalsolution.maintenanceevents.*

  • baremetalsolution.maintenanceevents.addProposal
  • baremetalsolution.maintenanceevents.approve
  • baremetalsolution.maintenanceevents.get
  • baremetalsolution.maintenanceevents.list

(roles/baremetalsolution.maintenanceeventseditor)

Editor of Bare Metal Solution maintenance events resources

baremetalsolution.maintenanceevents.*

  • baremetalsolution.maintenanceevents.addProposal
  • baremetalsolution.maintenanceevents.approve
  • baremetalsolution.maintenanceevents.get
  • baremetalsolution.maintenanceevents.list

(roles/baremetalsolution.maintenanceeventsviewer)

Viewer of Bare Metal Solution maintenance events resources

baremetalsolution.maintenanceevents.get

baremetalsolution.maintenanceevents.list

(roles/baremetalsolution.networksadmin)

Admin of Bare Metal Solution networks resources

baremetalsolution.networkquotas.list

baremetalsolution.networks.*

  • baremetalsolution.networks.create
  • baremetalsolution.networks.delete
  • baremetalsolution.networks.get
  • baremetalsolution.networks.list
  • baremetalsolution.networks.rename
  • baremetalsolution.networks.update

baremetalsolution.operations.get

baremetalsolution.pods.list

(roles/baremetalsolution.nfssharesadmin)

Administrator of Bare Metal Solution NFS Share resources

baremetalsolution.nfsshares.*

  • baremetalsolution.nfsshares.create
  • baremetalsolution.nfsshares.delete
  • baremetalsolution.nfsshares.get
  • baremetalsolution.nfsshares.list
  • baremetalsolution.nfsshares.rename
  • baremetalsolution.nfsshares.update

baremetalsolution.operations.get

baremetalsolution.pods.list

(roles/baremetalsolution.nfsshareseditor)

Editor of Bare Metal Solution NFS Share resources

baremetalsolution.nfsshares.*

  • baremetalsolution.nfsshares.create
  • baremetalsolution.nfsshares.delete
  • baremetalsolution.nfsshares.get
  • baremetalsolution.nfsshares.list
  • baremetalsolution.nfsshares.rename
  • baremetalsolution.nfsshares.update

baremetalsolution.operations.get

baremetalsolution.pods.list

(roles/baremetalsolution.nfssharesviewer)

Viewer of Bare Metal Solution NFS Share resources

baremetalsolution.nfsshares.get

baremetalsolution.nfsshares.list

baremetalsolution.operations.get

(roles/baremetalsolution.osimagesviewer)

Viewer of Bare Metal Solution OS images resources

baremetalsolution.osimages.list

(roles/baremetalsolution.procurementsadmin)

Administrator of Bare Metal Solution Procurements

baremetalsolution.pods.list

baremetalsolution.procurements.*

  • baremetalsolution.procurements.create
  • baremetalsolution.procurements.get
  • baremetalsolution.procurements.list

baremetalsolution.skus.list

(roles/baremetalsolution.procurementseditor)

Editor of Bare Metal Solution Procurements

baremetalsolution.pods.list

baremetalsolution.procurements.*

  • baremetalsolution.procurements.create
  • baremetalsolution.procurements.get
  • baremetalsolution.procurements.list

baremetalsolution.skus.list

(roles/baremetalsolution.procurementsviewer)

Viewer of Bare Metal Solution Procurements

baremetalsolution.procurements.get

baremetalsolution.procurements.list

baremetalsolution.skus.list

(roles/baremetalsolution.serviceAgent)

Gives permission to manage network resources such as interconnect pairing keys, required for Bare Metal Solution.

compute.interconnectAttachments.get

compute.interconnectAttachments.list

compute.interconnects.get

compute.interconnects.list

compute.networks.get

compute.networks.list

compute.projects.get

resourcemanager.projects.get

(roles/baremetalsolution.storageadmin)

Administrator of Bare Metal Solution storage resources

baremetalsolution.luns.*

  • baremetalsolution.luns.create
  • baremetalsolution.luns.delete
  • baremetalsolution.luns.evict
  • baremetalsolution.luns.get
  • baremetalsolution.luns.list
  • baremetalsolution.luns.update

baremetalsolution.nfsshares.*

  • baremetalsolution.nfsshares.create
  • baremetalsolution.nfsshares.delete
  • baremetalsolution.nfsshares.get
  • baremetalsolution.nfsshares.list
  • baremetalsolution.nfsshares.rename
  • baremetalsolution.nfsshares.update

baremetalsolution.operations.get

baremetalsolution.pods.list

baremetalsolution.snapshotschedulepolicies.*

  • baremetalsolution.snapshotschedulepolicies.create
  • baremetalsolution.snapshotschedulepolicies.delete
  • baremetalsolution.snapshotschedulepolicies.get
  • baremetalsolution.snapshotschedulepolicies.list
  • baremetalsolution.snapshotschedulepolicies.update

baremetalsolution.storageaggregatepools.list

baremetalsolution.volumequotas.list

baremetalsolution.volumes.*

  • baremetalsolution.volumes.create
  • baremetalsolution.volumes.delete
  • baremetalsolution.volumes.evict
  • baremetalsolution.volumes.get
  • baremetalsolution.volumes.list
  • baremetalsolution.volumes.rename
  • baremetalsolution.volumes.resize
  • baremetalsolution.volumes.update

baremetalsolution.volumesnapshots.*

  • baremetalsolution.volumesnapshots.create
  • baremetalsolution.volumesnapshots.delete
  • baremetalsolution.volumesnapshots.get
  • baremetalsolution.volumesnapshots.list
  • baremetalsolution.volumesnapshots.restore

resourcemanager.projects.get

resourcemanager.projects.list

(roles/baremetalsolution.viewer)

Viewer of Bare Metal Solution resources

baremetalsolution.instancequotas.list

baremetalsolution.instances.get

baremetalsolution.instances.list

baremetalsolution.luns.get

baremetalsolution.luns.list

baremetalsolution.maintenanceevents.get

baremetalsolution.maintenanceevents.list

baremetalsolution.networkquotas.list

baremetalsolution.networks.get

baremetalsolution.networks.list

baremetalsolution.nfsshares.get

baremetalsolution.nfsshares.list

baremetalsolution.operations.get

baremetalsolution.osimages.list

baremetalsolution.pods.list

baremetalsolution.procurements.get

baremetalsolution.procurements.list

baremetalsolution.skus.list

baremetalsolution.snapshotschedulepolicies.get

baremetalsolution.snapshotschedulepolicies.list

baremetalsolution.sshKeys.list

baremetalsolution.storageaggregatepools.list

baremetalsolution.volumequotas.list

baremetalsolution.volumes.get

baremetalsolution.volumes.list

baremetalsolution.volumesnapshots.get

baremetalsolution.volumesnapshots.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/baremetalsolution.volumesadmin)

Administrator of Bare Metal Solution volume resources

baremetalsolution.operations.get

baremetalsolution.pods.list

baremetalsolution.volumes.*

  • baremetalsolution.volumes.create
  • baremetalsolution.volumes.delete
  • baremetalsolution.volumes.evict
  • baremetalsolution.volumes.get
  • baremetalsolution.volumes.list
  • baremetalsolution.volumes.rename
  • baremetalsolution.volumes.resize
  • baremetalsolution.volumes.update

(roles/baremetalsolution.volumeseditor)

Editor of Bare Metal Solution volumes resources

baremetalsolution.operations.get

baremetalsolution.pods.list

baremetalsolution.volumequotas.list

baremetalsolution.volumes.create

baremetalsolution.volumes.delete

baremetalsolution.volumes.get

baremetalsolution.volumes.list

baremetalsolution.volumes.rename

baremetalsolution.volumes.resize

baremetalsolution.volumes.update

(roles/baremetalsolution.volumesnapshotsadmin)

Administrator of Bare Metal Solution snapshots resources

baremetalsolution.operations.get

baremetalsolution.volumesnapshots.*

  • baremetalsolution.volumesnapshots.create
  • baremetalsolution.volumesnapshots.delete
  • baremetalsolution.volumesnapshots.get
  • baremetalsolution.volumesnapshots.list
  • baremetalsolution.volumesnapshots.restore

(roles/baremetalsolution.volumesnapshotseditor)

Editor of Bare Metal Solution snapshots resources

baremetalsolution.operations.get

baremetalsolution.volumesnapshots.create

baremetalsolution.volumesnapshots.delete

baremetalsolution.volumesnapshots.get

baremetalsolution.volumesnapshots.list

(roles/baremetalsolution.volumesnapshotsviewer)

Viewer of Bare Metal Solution snapshots resources

baremetalsolution.operations.get

baremetalsolution.volumesnapshots.get

baremetalsolution.volumesnapshots.list

(roles/baremetalsolution.volumessviewer)

Viewer of Bare Metal Solution volumes resources

baremetalsolution.operations.get

baremetalsolution.volumes.get

baremetalsolution.volumes.list

Te recomendamos que apliques los roles de la siguiente manera:

  • Completa un formulario de admisión

    • Funciones de la solución Bare Metal: administrador, editor o administrador de instancias Y visualizador de red de Compute
    • Roles básicos: propietario o editor

  • Reinicia un servidor de la solución Bare Metal

    • Funciones de la solución Bare Metal: administrador o editor
    • Roles básicos: propietario o editor

  • Muestra una lista de servidores o solicita un estado

    • Funciones de la solución Bare Metal: Visualizador o visualizador de instancias
    • Función básica: Visualizador

  • Administra componentes de almacenamiento

    • Roles de la solución Bare Metal: administrador, editor o administrador de almacenamiento
    • Roles básicos: propietario o editor

  • Administra componentes de herramientas de redes

    • Roles de la solución Bare Metal: administrador, editor o administrador de redes
    • Roles básicos: propietario o editor

Para obtener una lista completa de los roles de Bare Metal Solution, consulta Roles predefinidos y, luego, ingresa baremetalsolution. en el cuadro de búsqueda.

Para obtener una lista completa de los permisos de la solución Bare Metal, consulta Cómo buscar un permiso y, luego, ingresa baremetalsolution. en el cuadro de búsqueda.

Otorga una función de IAM

Agrega una política de IAM para asignar un rol de solución Bare Metal a un principal. El rol contiene permisos que permiten que la cuenta principal realice ciertas acciones. Para otorgar una función:

Console

  1. Asegúrate de tener una función que contenga los permisos de IAM adecuados para asignar funciones a otros, comopropietario, Administrador de IAM de proyecto o Administrador de seguridad. Para obtener más información sobre este requisito, consulta Roles requeridos.

  2. En la Google Cloud consola, ve a la página de permisos de IAM.

    Ir a IAM

  3. Haz clic en Otorgar acceso.

  4. Ingresa la siguiente información:

    • En Agregar principales, ingresa a tus usuarios. Puedes agregar usuarios individuales, Grupos de Google, cuentas de servicio o dominios de Google Workspace.

    • En Asignar roles, elige un rol del menú Seleccionar un rol para otorgarlo a los principales.

    • Haz clic en Agregar otro rol si necesitas asignar varios roles a tus directores.

    • Haz clic en Guardar.

    Tus principales y sus roles asignados aparecen en la página de estado de los permisos de IAM.

gcloud

  1. Asegúrate de tener una función que contenga los permisos de IAM adecuados para asignar funciones a otros, comopropietario, Administrador de IAM de proyecto, o Administrador de seguridad. Para obtener más información sobre este requisito, consulta Roles requeridos.

  2. Abre una ventana de Cloud Shell en tu Google Cloud proyecto.

  3. Agrega el Google Cloud ID de tu proyecto, la dirección de correo electrónico de la cuenta de la Google Cloud persona principal y la ruta de la función de la solución Bare Metal deseada al siguiente comando:

    gcloud projects add-iam-policy-binding PROJECT_ID \
 --member=user:username@example.com \
 --role=roles/baremetalsolution.admin

  4. Copia el comando y pégalo en tu ventana de Cloud Shell.

  5. Presiona las teclas Intro o Volver.

  6. En algunos casos, se abrirá una ventana Autorizar Cloud Shell que solicitará que permitas una llamada a la API. Si ves esto, haz clic en Autorizar.

  7. Cuando hayas escrito los comandos correctamente, el resultado obtenido se verá así:

    Updated IAM policy for project [PROJECT_ID].
  bindings:
  - members:
   - user:username@example.com
   role: roles/baremetalsolution.admin
  - members:
   - serviceAccount:service-PROJECT_NUMBER@compute-system.iam.gserviceaccount.com
   role: roles/compute.serviceAgent
  - members:
   - serviceAccount:PROJECT_NUMBER-compute@developer.gserviceaccount.com
   - serviceAccount:PROJECT_NUMBER@cloudservices.gserviceaccount.com
   role: roles/editor
  - members:
   - user:username@example.com
   role: roles/owner
  etag: ETAG_NUMBER
  version: 1

Si quieres obtener más información sobre IAM, consulta Administración de identidades y accesos.